Mexico’s bankers and Condusef warn of malware used to commit bank fraud

The Mexican Bankers Association (ABM) and the National Commission for the Protection and Defence of Users of Financial Services (Condusef) have issued a joint preventive alert about bank fraud carried out with malware, according to Revista Fortuna. The warning follows the recent identification of financial fraud attempts using this kind of malicious software, and both bodies are urging customers to take extra care.

It starts outside the app. According to the ABM and Condusef, one of the main features of this type of fraud is that the attack can begin outside the banking app. Criminals send text messages, emails, phone calls or fake links designed to create worry or urgency. They may ask the victim to download an app, open a file, hand over confidential information or allow remote access to their phone.

What the malware does. Once installed, the malicious program can try to capture passwords, PINs and security codes, intercept information or control certain functions of the device. The techniques identified include remote control, screen overlays, malicious extensions and the installation of compromised files or apps.

Why it matters

Harder to detect. Because the malware can operate from the customer's own device once criminals have their credentials or authentication methods, it can be difficult for financial institutions to immediately recognise that a transaction was fraudulent. The alert says banks have strengthened prevention and communication with clients and are coordinating with financial authorities, but stresses that security also depends on users' habits.

Warning signs. The ABM and Condusef list as red flags messages that create urgency or threats; requests for passwords, PINs, verification codes or card details; instructions to install apps or remote access tools; suspicious links or pages; files from unknown senders; and unusual changes in how your phone behaves. Faced with these, they advise not downloading anything or opening files, and blocking and reporting the content.

• Install an antivirus and keep it, your operating system, browser and apps up to date.
• Download apps only from official stores.
• Never share passwords, PINs or verification codes, and don't install remote control tools because someone tells you to.
• Check the amount, recipient and destination account before authorising any transaction.
• Turn on transaction alerts and log in through the bank's official app, not links in messages.

If your phone is compromised. If you suspect infection or spot a transaction you don't recognise, the advice is to stop the transaction, disconnect the device from the internet and contact your bank immediately through official channels. Change your passwords from a secure device. To avoid fake numbers or sites supplied by criminals, use the number on the back of your card or the contact details on the bank's official website.

Source: Revista Fortuna / ABM